crypto/tls: TestVerifyConnection/TLSv12 failures

[gopherbot]

#!watchflakes
default <- pkg == "crypto/tls" && test == "TestVerifyConnection/TLSv12"

Issue created automatically to collect these failures.

Example (log):

=== RUN   TestVerifyConnection/TLSv12
    handshake_client_test.go:1766: RequireAndVerifyClientCert-FullHandshake: handshake failed: server: remote error: tls: bad certificate
        client: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-01-01T02:46:41Z is after 2025-01-01T00:00:00Z
--- FAIL: TestVerifyConnection/TLSv12 (0.08s)

— watchflakes

[gopherbot]

Found new dashboard test flakes for:

#!watchflakes
default <- pkg == "crypto/tls" && test == "TestVerifyConnection/TLSv12"

2024-12-30 20:23 gotip-netbsd-arm go@b702a26c crypto/tls.TestVerifyConnection/TLSv12 (log)

=== RUN   TestVerifyConnection/TLSv12
    handshake_client_test.go:1766: RequireAndVerifyClientCert-FullHandshake: handshake failed: server: remote error: tls: bad certificate
        client: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-01-01T02:46:41Z is after 2025-01-01T00:00:00Z
--- FAIL: TestVerifyConnection/TLSv12 (0.08s)

— watchflakes

[4a6f656c]

Most of the test certificates (e.g. testRSACertificate, testRSACertificateIssuer, testRSA2048CertificateIssuer) have a not after of Jan 1 00:00:00 2025 GMT.

[gopherbot]

Change https://go.dev/cl/639595 mentions this issue: crypto/tls: update the expiration time of the certificate in the test case

[ianlancetaylor]

As far as I can tell one of the failing certificates is testRSA2048CertificateIssuer in crypto/tls/handshake_test.go. This certificate was just added in https://go.dev/cl/629736 committed in November, 2024, so this test was only going to work for a few weeks. Unfortunately I don't know how to correctly recreate this certificate with a more useful expiration date.

CC @golang/security @rolandshoemaker @FiloSottile @cpu

[gopherbot]

Change https://go.dev/cl/639655 mentions this issue: crypto/tls: fix Config.Time in tests using expired certificates

[cuishuang]

Change https://go.dev/cl/639595 mentions this issue: crypto/tls: update the expiration time of the certificate in the test case

I tried to generate a certificate with an expiration date of 2026-01-01, which passed the verification of func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *VerifyOptions) error, but the complete test still reported an error

The maintainer is fixing the problem here in CL 639655, and I will abandon this CL.